Oracle E-Business Suite CVE-2026-91496

Exploitation targets the Workflow Notification Mailer component of Oracle E-Business Suite Workflow, versions 12.2.3 through 12.2.15, reachable over HTTP. The attacker must hold valid low-privileged credentials on the EBS instance (PR:L - authenticated per the CVSS vector), so this is not an unauthenticated flaw. Exploitation is further limited by high attack complexity (AC:H): Oracle rates it 'difficult to exploit,' implying a specific server state, timing, or precondition that is not reliably met on demand. No end-user interaction is required (UI:N). Primary limiting factors for defenders: valid account required, HTTP access to the Notification Mailer must be exposed, and the high-complexity trigger reduces reliability of attacks.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:L/UI:N - network-reachable over HTTP but explicitly marked high attack complexity (AC:H) and requiring low-level authentication (PR:L). Oracle itself classifies it as 'Difficult to exploit,' which aligns with the AC:H metric and tempers the otherwise serious C:H/I:H/A:H 'takeover of Workflow' impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - the elevated score is driven purely by impact, not by demonstrated exploitability. Signals are therefore consistent (high impact offset by high complexity and required privileges) with no conflicts, but note the input Tag 'Information Disclosure' understates the actual scope, since the vector and description indicate full confidentiality, integrity AND availability compromise, not mere disclosure. Treat as a should-patch-in-cycle item during the Oracle October 2026 CPU window rather than a drop-everything zero-day.

An attacker who already holds a low-privileged account on an internet- or intranet-reachable Oracle E-Business Suite instance sends a series of crafted HTTP requests to the Workflow Notification Mailer component, exploiting a difficult-to-trigger condition to escalate into full control of the Workflow product (confidentiality, integrity, and availability). Because AC:H reflects a non-trivial precondition or timing/state requirement, reliable exploitation likely needs multiple attempts or specific server state. No public exploit code was identified at time of analysis.